@piercebarney/whs-eleventy 2026.9.1 → 2026.9.2

package/lib/a11y.js

@@ -46,11 +46,19 @@ const getJSON = (url) =>
 function sitemapPaths() {
   const xml = fs.readFileSync(path.join(SITE, "sitemap.xml"), "utf8");
   const paths = [...xml.matchAll(/<loc>([^<]+)<\/loc>/g)].map((m) => new URL(m[1]).pathname);
+  // The audit page and the 404 page are both deliberately excluded from the
+  // sitemap (core.md#sitemap-robots) but are still real pages a visitor
+  // lands on — the a11y Contract says "every page", not "every sitemap
+  // entry", so scan them explicitly.
   paths.push("/audit/");
+  if (fs.existsSync(path.join(SITE, "404.html"))) paths.push("/404.html");
   return [...new Set(paths)];
 }
 
 function connect(wsUrl) {
+  // The global `WebSocket` is stable only from Node 22 — package.json's
+  // `engines.node` reflects that (it does not exist, even unflagged, on
+  // Node 20, which this file used to silently assume it did).
   const ws = new WebSocket(wsUrl);
   let id = 0;
   const pending = {};

package/lib/check-links.js

@@ -125,7 +125,7 @@ function outputHas(urlPath) {
   return fs.existsSync(asFile + "/index.html") || fs.existsSync(asFile + ".html");
 }
 
-function checkRef(file, pageUrl, raw, { external = true } = {}) {
+function checkRef(file, pageUrl, raw, { external = true, isHyperlink = false } = {}) {
   if (!raw) return;
   const v = raw.trim();
   if (v === "" || v.startsWith("data:") || v.startsWith("mailto:") || v.startsWith("tel:")) return;
@@ -140,7 +140,14 @@ function checkRef(file, pageUrl, raw, { external = true } = {}) {
     }
     if (origin === site.url) {
       if (!outputHas(new URL(v).pathname)) err(file, `absolute link to a missing page: ${v}`);
-    } else if (!allowedOrigins.has(origin) && !POLICY_LINK_ORIGINS.has(origin)) {
+    } else if (
+      !allowedOrigins.has(origin) &&
+      // POLICY_LINK_ORIGINS are informational <a> targets that never load a
+      // resource or receive visitor data (see its definition above) — that
+      // exemption applies only to plain hyperlinks, never to a resource
+      // reference (script/link/img/og:image), which does load from the origin.
+      !(isHyperlink && POLICY_LINK_ORIGINS.has(origin))
+    ) {
       err(file, `external origin not in thirdparties.js: ${origin}`);
     }
     return;
@@ -198,7 +205,7 @@ for (const f of htmlFiles) {
 
   root.querySelectorAll("a[href]").forEach((a) => {
     const href = a.getAttribute("href");
-    checkRef(f, pageUrl, href);
+    checkRef(f, pageUrl, href, { isHyperlink: true });
     if (/^https?:\/\//i.test(href || "")) {
       let origin;
       try {
@@ -242,6 +249,31 @@ for (const f of htmlFiles) {
   });
 }
 
+// ---- JS-level origin scan (core.md#third-parties) --------------------------
+// The HTML walk above only ever sees origins referenced in markup — a runtime
+// browser `fetch()`/`new URL()` call baked into a shipped .js file is
+// invisible to it. This is a best-effort literal-string scan (it cannot see a
+// dynamically-built URL), but it catches the common case: a hardcoded
+// external origin in client JS that was never added to the manifest.
+(function checkJsOrigins() {
+  const jsFiles = allFiles.filter((f) => f.endsWith(".js") && !f.endsWith("links-report.json"));
+  const ORIGIN_LITERAL = /(?:fetch|new\s+URL)\s*\(\s*[`'"](https?:\/\/[^`'"\s]+)[`'"]/g;
+  for (const f of jsFiles) {
+    const text = fs.readFileSync(f, "utf8");
+    for (const m of text.matchAll(ORIGIN_LITERAL)) {
+      let origin;
+      try {
+        origin = new URL(m[1]).origin;
+      } catch {
+        continue;
+      }
+      if (origin !== site.url && !allowedOrigins.has(origin)) {
+        err(f, `fetch()/URL() targets an origin not in thirdparties.js: ${origin}`);
+      }
+    }
+  }
+})();
+
 // ---- ads: production-only, ads.txt present (core.md#ads) -------------------
 (function checkAds() {
   const ads = tryProjectRequire("src/_data/ads.js", {});

package/lib/compliance.js

@@ -16,6 +16,7 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const { execSync } = require("node:child_process");
+const { parse: parseHtml } = require("node-html-parser");
 const { runRepoChecks } = require("./doctor.js");
 const { ROOT, resolveStandard } = require("./_project.js");
 
@@ -86,13 +87,23 @@ const loadDoctor = () => {
   doc = {};
   for (const c of runRepoChecks({ preflight: false })) doc[c.id] = c;
 };
-const fromDoctor = (id, extra = "") => {
+// `strict: true` is for chapters whose Contract has no "advisory" reading —
+// doctor's own "warn" severity is right for its own informational printing,
+// but a compliance chapter reporting MANUAL for "no CSP at all" or "wrong
+// Node" hides a real, mechanically-known violation from `--strict`. Only the
+// compliance view remaps warn -> FAIL; doctor.js's own severity is untouched.
+const fromDoctor = (id, extra = "", { strict = false, missingIsFail = false } = {}) => {
   const c = doc[id];
-  if (!c) return { status: MANUAL, note: `doctor check ${id} not found` };
-  return {
-    status: c.severity === "ok" ? PASS : c.severity === "blocker" ? FAIL : MANUAL,
-    note: [c.detail, extra].filter(Boolean).join(" · "),
-  };
+  if (!c) {
+    return missingIsFail
+      ? {
+          status: FAIL,
+          note: [`doctor check ${id} could not run`, extra].filter(Boolean).join(" · "),
+        }
+      : { status: MANUAL, note: `doctor check ${id} not found` };
+  }
+  const status = c.severity === "ok" ? PASS : c.severity === "blocker" || strict ? FAIL : MANUAL;
+  return { status, note: [c.detail, extra].filter(Boolean).join(" · ") };
 };
 
 // ---- per-chapter checks ------------------------------------------------
@@ -115,6 +126,11 @@ const CHECKS = {
   "runtime-pin": () => {
     if (/NODE_VERSION/.test(read("netlify.toml") || ""))
       return { status: FAIL, note: "NODE_VERSION in netlify.toml — use .nvmrc" };
+    if (!has(".nvmrc"))
+      return { status: FAIL, note: ".nvmrc missing — no single pinned runtime version" };
+    // A running-Node/.nvmrc major mismatch is a MANUAL judgment (the developer's
+    // local shell may just not have `nvm use`'d yet) — everything else about the
+    // pin (single source, present) is mechanically FAIL-able.
     return fromDoctor("nvmrc-node");
   },
 
@@ -146,7 +162,22 @@ const CHECKS = {
 
   rendering: () => {
     if (!has("src/404.njk")) return { status: FAIL, note: "no src/404.njk" };
-    return { status: PASS, note: "server-rendered HTML; 404 page present" };
+    // A page whose <main> is empty/near-empty in the built output is the
+    // classic "content only appears after client JS runs" regression the
+    // Contract forbids — a crude but real content-presence check, distinct
+    // from merely confirming a 404 template exists.
+    const thin = siteHtml().filter((f) => {
+      const root = parseHtml(fs.readFileSync(f, "utf8"));
+      const main = root.querySelector("main");
+      const text = (main ? main.text : root.text || "").replace(/\s+/g, " ").trim();
+      return text.length < 40;
+    });
+    if (thin.length)
+      return {
+        status: FAIL,
+        note: `${thin.length} page(s) with near-empty <main> — content may be client-rendered only`,
+      };
+    return { status: PASS, note: "server-rendered HTML with real content; 404 page present" };
   },
 
   assets: () => {
@@ -223,20 +254,44 @@ const CHECKS = {
   },
 
   "og-image": () => {
-    let bad = 0;
+    // PNG IHDR: an 8-byte signature, then a 4-byte length + "IHDR" + a
+    // 4-byte width + 4-byte height, big-endian, at fixed offsets — no decoder
+    // dependency needed to read just the dimensions.
+    const pngSize = (rel) => {
+      let buf;
+      try {
+        buf = fs.readFileSync(path.join(ROOT, rel));
+      } catch {
+        return null;
+      }
+      if (buf.length < 24 || buf.toString("ascii", 12, 16) !== "IHDR") return null;
+      return { width: buf.readUInt32BE(16), height: buf.readUInt32BE(20) };
+    };
+    const bad = [];
     for (const f of siteHtml()) {
+      const rel = path.relative(ROOT, f);
       const m = fs
         .readFileSync(f, "utf8")
         .match(/property="og:image" content="[^"]*?\/og\/([^"]+?)\.png"/);
       if (!m) {
-        bad++;
+        bad.push(`${rel} (no og:image)`);
         continue;
       }
-      if (!has(`_site/og/${m[1]}.png`)) bad++;
+      const cardRel = `_site/og/${m[1]}.png`;
+      if (!has(cardRel)) {
+        bad.push(`${rel} (${cardRel} missing)`);
+        continue;
+      }
+      const dims = pngSize(cardRel);
+      if (!dims || dims.width !== 1200 || dims.height !== 630) {
+        bad.push(
+          `${rel} (${cardRel} is ${dims ? `${dims.width}x${dims.height}` : "not a PNG"}, not 1200x630)`,
+        );
+      }
     }
-    return bad
-      ? { status: FAIL, note: `${bad} page(s) with a missing/!1200x630 og:image` }
-      : { status: PASS, note: "every og:image resolves" };
+    return bad.length
+      ? { status: FAIL, note: `${bad.length} page(s): ${bad.slice(0, 5).join("; ")}` }
+      : { status: PASS, note: "every og:image resolves at 1200x630" };
   },
 
   "structured-data": () => {
@@ -258,11 +313,31 @@ const CHECKS = {
     };
   },
 
-  noindex: () =>
-    fromDoctor(
-      "prod-indexable",
-      "DEPLOY_TARGET unset => noindex present (verified in check-links)",
-    ),
+  noindex: () => {
+    // doctor's `prod-indexable` repo-tier check only *describes* the built
+    // output's current noindex state — it does not judge it (that's what
+    // `--deploy-preflight` is for). Judging the actual Contract — "a
+    // non-production build always carries noindex" — needs its own check
+    // here: verify the SOURCE gate exists (independent of whichever build
+    // happens to be sitting in _site/), and additionally check the built
+    // output when we can tell which target it was built for.
+    const layout = read("src/_includes/layout.njk") || "";
+    const robots = read("src/robots.njk") || "";
+    if (!/build\.isProduction/.test(layout) || !/noindex/i.test(layout))
+      return { status: FAIL, note: "layout.njk has no build.isProduction-gated noindex meta" };
+    if (!/build\.isProduction/.test(robots))
+      return { status: FAIL, note: "robots.njk Disallow is not keyed on build.isProduction" };
+    const home = read("_site/index.html");
+    if (home !== null && process.env.DEPLOY_TARGET !== "production") {
+      const indexable = !/<meta[^>]+name=["']robots["'][^>]+noindex/i.test(home);
+      if (indexable)
+        return {
+          status: FAIL,
+          note: "_site/index.html is indexable but DEPLOY_TARGET is not production",
+        };
+    }
+    return { status: PASS, note: "layout.njk + robots.njk gate on build.isProduction" };
+  },
 
   "brand-source": () => {
     // Per the standard: grep src/, static/style.css, scripts/og-card.js|icons.js.
@@ -302,8 +377,19 @@ const CHECKS = {
     return { status: PASS, note: "noindex; show-all toggle; all tabs present" };
   },
 
-  "security-headers": () =>
-    fromDoctor("security-headers", doc["csp-thirdparties"] ? doc["csp-thirdparties"].detail : ""),
+  "security-headers": () => {
+    if (!has("netlify.toml"))
+      return { status: FAIL, note: "no netlify.toml — no security headers declared" };
+    // A missing/incomplete header set, or a CSP that grants an origin outside
+    // the declared manifest, are mechanically-known Contract violations, not
+    // judgment calls — FAIL them rather than leaving them an invisible-to
+    // ---strict MANUAL.
+    const headers = fromDoctor("security-headers", "", { strict: true, missingIsFail: true });
+    const csp = fromDoctor("csp-thirdparties", "", { strict: true, missingIsFail: true });
+    if (headers.status === FAIL) return headers;
+    if (csp.status === FAIL) return csp;
+    return { status: PASS, note: [headers.note, csp.note].filter(Boolean).join(" · ") };
+  },
 
   caching: () => {
     const toml = read("netlify.toml") || "";
@@ -353,7 +439,11 @@ const CHECKS = {
       };
     // Real ad CODE (not a bare origin string the audit page shows as data).
     const AD_CODE = /adsbygoogle\.js|<ins[^>]+adsbygoogle|google-adsense-account/;
-    const prod = doc["prod-indexable"] && /indexable/.test(doc["prod-indexable"].detail || "");
+    // Read the built output directly rather than regex-matching another
+    // check's human-readable detail string — the same source check-links.js
+    // and the noindex check above use.
+    const home = read("_site/index.html");
+    const prod = home !== null && !/<meta[^>]+name=["']robots["'][^>]+noindex/i.test(home);
     const leak = siteHtml().filter((f) => AD_CODE.test(fs.readFileSync(f, "utf8")));
     if (!prod && leak.length)
       return { status: FAIL, note: `ad code in ${leak.length} non-production page(s)` };
@@ -371,13 +461,21 @@ const CHECKS = {
   },
 
   forms: () => {
-    const layout = read("src/_includes/layout.njk") || "";
+    // A form can live anywhere in the built output, not only in layout.njk
+    // (a contact page's own template, say) — scan every page, and treat "no
+    // form anywhere" as N/A rather than a false FAIL on a site that has none.
+    const pagesWithForms = siteHtml().filter((f) => /<form[\s>]/i.test(fs.readFileSync(f, "utf8")));
+    if (!pagesWithForms.length) return { status: NA, note: "no <form> in the built output" };
+    const hasHoneypot = pagesWithForms.some((f) =>
+      /netlify-honeypot|name="bot-field"/.test(fs.readFileSync(f, "utf8")),
+    );
+    if (!hasHoneypot) return { status: FAIL, note: "no honeypot field in the form" };
     const handlers = grepSrc(/addEventListener\(["']submit["']/, [".js"]);
-    if (!/netlify-honeypot|name="bot-field"/.test(layout))
-      return { status: FAIL, note: "no honeypot field in the form" };
     if (handlers.length > 1)
       return { status: FAIL, note: `submit handler in ${handlers.length} files — consolidate` };
-    return { status: PASS, note: "one handler in site.js; honeypot present" };
+    if (handlers.length === 0)
+      return { status: FAIL, note: "a form exists but no submit handler was found" };
+    return { status: PASS, note: "one handler; honeypot present" };
   },
 
   "domain-tests": () => {
@@ -404,13 +502,18 @@ const CHECKS = {
     };
   },
 
-  "the-gate": () =>
-    fromDoctor(
-      "gate-stages",
-      /doctor|compliance/.test(JSON.parse(read("package.json")).scripts.check)
-        ? "doctor/compliance leaked into check"
-        : "doctor + compliance kept out",
-    ),
+  "the-gate": () => {
+    // A gate missing a stage (e.g. a11y quietly dropped from `check`) is a
+    // mechanically-known Contract violation — FAIL it, don't bury it in MANUAL.
+    const leaked = /doctor|compliance/.test(
+      (JSON.parse(read("package.json") || "{}").scripts || {}).check || "",
+    );
+    if (leaked) return { status: FAIL, note: "doctor/compliance leaked into `npm run check`" };
+    return fromDoctor("gate-stages", "doctor + compliance kept out", {
+      strict: true,
+      missingIsFail: true,
+    });
+  },
 
   compliance: () => {
     const pkg = JSON.parse(read("package.json") || "{}");
@@ -564,7 +667,20 @@ function changelogSlugs(changelog, pin) {
     const coreM = line.match(/^###\s+core:\s+(.+)/);
     if (coreM) {
       for (const part of coreM[1].split(/[·,]/)) {
-        const slug = (part.trim().match(/^[a-z0-9-]+/) || [])[0];
+        // Strip wrapping punctuation a heading can carry — `(a, b, c)`
+        // splits into parts like `(a` and `c)` — before matching, or the
+        // leading "(" makes the slug regex miss the first entry entirely.
+        const cleaned = part.trim().replace(/^[^a-z0-9]+|[^a-z0-9]+$/gi, "");
+        if (!cleaned) continue;
+        if (/^all$/i.test(cleaned)) {
+          // "### core: all" (the initial-split entry) means every chapter,
+          // not a literal slug named "all" — the registry has no such slug,
+          // so emitting it as one would print a `MANUAL: re-check #all` row
+          // that looks real but isn't.
+          slugs.add("(all core chapters)");
+          continue;
+        }
+        const slug = (cleaned.match(/^[a-z0-9-]+/) || [])[0];
         if (slug) slugs.add(slug);
       }
     }
@@ -674,4 +790,6 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { runCompliance, summarize, changelogSlugs };
+// CHECKS is exported for the "coverage" test — nothing else should read it as
+// data (call runCompliance() for results).
+module.exports = { runCompliance, summarize, changelogSlugs, CHECKS };

package/lib/doctor.js

@@ -22,6 +22,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { execSync } = require("node:child_process");
 const { ROOT, projectRequire } = require("./_project.js");
+const { asRegexMap } = require("./header-expect.js");
 
 const CACHE = path.join(ROOT, ".cache", "doctor.json");
 
@@ -30,14 +31,9 @@ const CACHE = path.join(ROOT, ".cache", "doctor.json");
 const loadSite = () => projectRequire("src/_data/site.js");
 const loadThirdparties = () => projectRequire("src/_data/thirdparties.js");
 
-// Live values expected on every response — same patterns the /audit/ page uses.
-const HEADER_EXPECT = {
-  "Content-Security-Policy": /default-src 'self'/,
-  "X-Content-Type-Options": /nosniff/,
-  "X-Frame-Options": /DENY|SAMEORIGIN/,
-  "Referrer-Policy": /strict-origin/,
-  "Permissions-Policy": /geolocation=\(\)/,
-};
+// Expected header value patterns — the single source (header-expect.js) also
+// feeds the /audit/ page's live-header check via _data/headerExpect.js.
+const HEADER_EXPECT = asRegexMap();
 
 const GATE_STAGES = ["lint", "validate", "test", "build", "links", "a11y"];
 

package/lib/header-expect.js

@@ -0,0 +1,34 @@
+// The baseline security-header value patterns (core.md#security-headers),
+// shared by two runtimes that can't `require()` each other:
+//   - doctor.js (Node) — reads them against the netlify.toml *declaration*.
+//   - the audit page's static/audit.js (browser) — reads them against the
+//     *live* response headers on `/`.
+// Regex patterns are kept as source strings, not RegExp objects, so this one
+// array can cross the Node -> build-data -> browser boundary as JSON (a
+// project's `_data/headerExpect.js` re-exports this; audit.njk embeds it as
+// an inline JSON block; static/audit.js reads that instead of hardcoding its
+// own copy). Changing an expected value here changes both checks at once.
+
+const HEADER_EXPECT = [
+  ["content-security-policy", "default-src 'self'"],
+  ["x-content-type-options", "nosniff"],
+  ["x-frame-options", "DENY|SAMEORIGIN"],
+  ["referrer-policy", "strict-origin"],
+  ["permissions-policy", "geolocation=\\(\\)"],
+];
+
+// Node-side convenience: the same list as compiled RegExp objects, keyed by
+// the doctor.js header-name casing it already uses.
+function asRegexMap() {
+  const map = {};
+  for (const [key, pattern] of HEADER_EXPECT) {
+    const headerName = key
+      .split("-")
+      .map((w) => w[0].toUpperCase() + w.slice(1))
+      .join("-");
+    map[headerName] = new RegExp(pattern);
+  }
+  return map;
+}
+
+module.exports = { HEADER_EXPECT, asRegexMap };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piercebarney/whs-eleventy",
-  "version": "2026.9.1",
+  "version": "2026.9.2",
   "description": "The web house style's Eleventy + Netlify tooling — the compliance sweep, the infra doctor, the link/CSP integrity check, and the a11y scan, shared by every project on the stack.",
   "bin": {
     "whs": "cli.js"
@@ -28,7 +28,7 @@
     "directory": "packages/whs-eleventy"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "dependencies": {
     "axe-core": "^4.13.0",

package/standard/CHANGELOG.md

@@ -8,6 +8,154 @@ Format: `## <date>` → `### core: <slug>` / `### <stack>` entries.
 
 ---
 
+## 2026-09-02 — closing the gap between the compliance grid and the Contracts it checks
+
+A pass through every chapter's actual enforcement, prompted by an outside
+evaluation that traced specific checks to specific failure modes they
+couldn't catch. Nothing here is a new chapter — it's the existing ones made to
+actually fail when their Contract is violated, plus the doc-accuracy and
+consistency defects the same pass turned up.
+
+### core: noindex
+
+- **The header-backstop layer (spec 2) is honestly scoped.** It no longer
+  reads as a universal "bonus" — the wording now says an impl doc states
+  plainly whether the layer applies to that stack's deploy model at all, since
+  a platform's per-context header config may not reach every deploy path (a
+  manually-uploaded artifact bypassing the platform's normal build pipeline,
+  for one).
+
+### core: adopting
+
+- The `standard-version` pin's example comment changes from `# optional pin`
+  to `# recommended — enables standard-version drift tracking (#compliance)`
+  — `#compliance`'s own check already treats it as required; the doc
+  contradicted the code.
+
+### docs — drift-guard registry sync
+
+- `core.md`'s Appendix **shared-concept drift guard** list now matches
+  `CLAUDE.md`'s (it had drifted to two different lists): adds `compliance`,
+  `ads`, `llm-integration` to `core.md`'s Appendix and the `README.md` copy.
+  All three now list the same ten slugs. (Not written as `### core: <slug>`
+  above — the Appendix is a registry, not a chapter, and `changelogSlugs()`
+  would otherwise mis-parse "registry" as a literal chapter slug.)
+
+### stacks/eleventy-netlify.md · phoenix.md · sveltekit.md
+
+- **`repo-hygiene` · `runtime-pin` · `config-idiom` now have real mirrored
+  sections in all three files.** `core.md` has said "see your stack's impl
+  doc, same slug" for these three chapters from the start; no stack file ever
+  actually carried that heading — the mechanism lived under differently-named
+  impl-only sections instead. Each new section is a one-line Core-contract
+  pointer at the existing impl-only content, not a restatement. `bin/check`'s
+  second check (below) now actually depends on this.
+
+### stacks/eleventy-netlify.md
+
+- **`#noindex`'s header-backstop layer is not attempted on this stack**, and
+  says why: Netlify's own docs are explicit that `[[headers]]` — and so any
+  `[[context.<name>.headers]]` block — is not context-aware; a netlify.toml
+  header declaration is global for every deploy regardless of context. The
+  documented workaround needs Netlify's build system to run, which `#ci-cd`
+  here deliberately disables. `templates/eleventy-netlify/netlify.toml` drops
+  the `[[context.deploy-preview.headers]]` / `[[context.branch-deploy.headers]]`
+  blocks it used to ship — they TOML-parsed cleanly but did nothing.
+- **`#caching`'s example now matches what the template actually ships** (a
+  per-file-type `/*.html` / `/*.css` / `/*.js` revalidate rule) instead of a
+  fingerprint-variant example that neither matched the shipped `netlify.toml`
+  nor satisfied `whs compliance`'s own `#caching` check. Also notes the
+  `/*.html` glob's directory-permalink matching isn't precisely documented by
+  Netlify (a real user report exists of `.html` not matching as expected) —
+  verify live rather than assume; `/audit/`'s live-header panel now shows the
+  actual `Cache-Control` value for exactly this.
+
+### stacks/phoenix.md
+
+- **Two fabricated APIs, corrected against the real source.** `Plug.CSP` and
+  a `content_security_policy` endpoint option don't exist (verified against
+  the real `plug`/`phoenix` packages) — the CSP-nonce section now describes
+  the actual mechanism (a custom plug assigning a per-request nonce before
+  `put_secure_browser_headers/2` builds the header). `Plug.Rewrite` doesn't
+  exist either — the redirect section now uses the real, verified API
+  (`conn |> put_status(:moved_permanently) |> redirect(to: …)`, since
+  `redirect/2` takes its status from `conn.status`, not a `:status` option).
+- **`TODO` — no reference implementation exists** banners added to
+  `internal-links`, `a11y`, `the-gate`, and `compliance` — these presented
+  `mix links.check` / `mix a11y` / `mix whs.check` as shipped tooling; none of
+  it exists yet. `the-gate`'s `mix check` snippet now says explicitly which 2
+  of its 10 steps are placeholders vs. real off-the-shelf deps.
+
+### tooling
+
+- **`packages/whs-eleventy` — the compliance checks now actually fail.**
+  `#noindex` was a structurally unconditional `PASS` in the non-preflight
+  path (`doctor.js`'s `prod-indexable` check always set `ok: true` there); it
+  now verifies the `build.isProduction` gate exists in `layout.njk` /
+  `robots.njk` and, when the built output is available, that it matches. A
+  missing/incomplete CSP or a dropped gate stage previously degraded to an
+  invisible `MANUAL`; `#security-headers` and `#the-gate` now FAIL on those.
+  `#og-image` now reads the built card's actual PNG dimensions (no new
+  dependency — a fixed-offset IHDR read) instead of only checking the file
+  exists. `#rendering` now checks built pages for near-empty `<main>` content,
+  not only that `404.njk` exists. `#forms` returns `N/A` on a site with no
+  form instead of a false `FAIL`, and now scans the whole built output rather
+  than only `layout.njk`. `#ads`'s production-detection reads the built
+  output directly instead of regexing another check's human-readable string.
+- **`check-links.js`:** the informational-link-only exemption
+  (`POLICY_LINK_ORIGINS`) no longer applies to `script`/`link`/`img`
+  references — only plain `<a href>`. A new best-effort scan of shipped `.js`
+  output catches a hardcoded `fetch()`/`new URL()` call to an origin outside
+  the manifest, which the HTML-only walk could never see.
+- **`a11y.js`:** `engines.node` is now `>=22` (verified against real Node
+  20/22 installs — the global `WebSocket` this file uses doesn't exist on 20,
+  contradicting the previous `>=20`). The scan now also covers `/404.html`,
+  deliberately excluded from the sitemap but still a real page.
+- **`changelogSlugs()`:** fixed dropping the first entry of a
+  parenthesis-wrapped multi-slug heading (`### core: (a, b, c)`), and no
+  longer emits a bogus literal `#all` slug for `### core: all` — that's now a
+  `(all core chapters)` sentinel.
+- **New shared module `lib/header-expect.js`** — the baseline security-header
+  patterns `doctor.js` and the `/audit/` page's live-header check each used to
+  hardcode independently now come from one source; the template bakes it into
+  the audit page's existing data block at build time.
+- **New fixture-based test coverage** (`test/compliance-checks.test.js`) for
+  the eight chapters above — a reusable throwaway-project harness, PASS and
+  FAIL cases each.
+- **`bin/check`'s second check redesigned.** It used to hash each stack
+  file's *intersection* with core's slug set and compare hashes across
+  files — green even when a chapter was mirrored in *none* of them (exactly
+  the `repo-hygiene`/`runtime-pin`/`config-idiom` gap above). It now diffs
+  each **active** stack (`index.json` `status: active`) directly against
+  core's full slug set. A draft/parked stack is deliberately exempt from full
+  mirroring — check #1 still holds it to "any `core.md#` reference it cites
+  must resolve" — so the standard gaining a chapter no longer forces an edit
+  in a stack nothing is built on yet.
+- The third check's restated-principle grep is widened (still a heuristic,
+  now says so). `bin/set-version` and `bin/check`'s version-agreement check
+  now also cover `README.md`'s `standard-version` example, which had drifted
+  stale and untracked.
+
+### templates/eleventy-netlify
+
+- **The `draft` content flag is now wired**, matching the spec
+  `stacks/eleventy-netlify.md#content-model` has always stated: an optional
+  boolean in `guides.schema.json` + `schema.js`, and `guides.11tydata.js`'s
+  `eleventyComputed` sets `permalink: false` + `eleventyExcludeFromCollections:
+  true` only when `draft && build.isProduction`.
+- **`bin/init`** now warns loudly (and adds a numbered follow-up step) when a
+  brief's `css:` answer doesn't match what the template actually ships
+  (`pico-classes`) — previously the key was recorded in `CLAUDE.md` as if
+  applied, with nothing behind it. The tooling pin it writes is `>=X.Y.Z`, not
+  `^X.Y.Z` — the package's major digit is the release year, not a
+  breaking-change signal, so a caret range silently stopped matching every
+  January 1st.
+- `.claude/settings.json`'s hook matcher and `og-guard.sh`'s watched-file
+  globs now match what `stacks/eleventy-netlify.md` documents (`MultiEdit`,
+  `static/fonts/*`).
+
+---
+
 ## 2026-09-01 — the shared tooling package (#compliance mechanism, eleventy)
 
 ### stacks/eleventy-netlify.md
@@ -37,8 +185,9 @@ Format: `## <date>` → `### core: <slug>` / `### <stack>` entries.
 - **`.github/workflows/publish.yml`** publishes `@piercebarney/whs-eleventy` to
   npm when a `YYYY-MM-DD` version tag is pushed — it lints + tests the package,
   checks the tag date (dotted) matches `package.json`, and publishes unless that
-  version is already up. Needs the `@piercebarney` npm scope and an `NPM_TOKEN`
-  repo secret. `--provenance` is omitted (needs a public source repo).
+  version is already up. Auth is npm **Trusted Publishing** (OIDC) — no token,
+  no secret, one-time `Trusted Publisher` setup on the package's npm settings.
+  Provenance is auto-skipped for the private source repo.
 - `standard.yml` gains a `package` job (prettier + eslint + `node:test`); the
   `templates` job installs the file: package's own tree and points
   `WHS_STANDARD` at the checkout so drift is checked against the live standard.

package/standard/core.md

@@ -1,6 +1,6 @@
 # Web project house style — CORE (stack-agnostic)
 
-**Version:** 2026-09-01 · **Status:** active
+**Version:** 2026-09-02 · **Status:** active
 
 This is the stack-agnostic contract every web project follows, regardless of
 framework, host, or CSS system. It says **what** must be true, with concrete
@@ -412,7 +412,11 @@ by three layers in order of reliance.
    non-production build.
 2. **Header backstop:** the host's response headers add `X-Robots-Tag: noindex`
    for preview/branch contexts where the platform supports it. Treated as a
-   bonus — not relied on.
+   bonus — never relied on, and never assumed present without checking: a
+   platform's per-context header config may not apply to every deploy path
+   (e.g. a manually-uploaded artifact bypassing that platform's normal build
+   pipeline) — the impl doc states plainly whether this layer actually
+   applies to the stack's deploy model, or is a no-op there.
 3. **Canonical:** every page's canonical points at the production origin, so an
    indexed stray still redirects search engines to production.
 
@@ -1333,6 +1337,11 @@ governs it and follow that chapter — the slugs are the index (a `<script>` →
 - A conflict between the current code and a chapter is a **migration gap** —
   surface it; don't quietly fix it inside an unrelated task and don't quietly
   route around it.
+- A defect in the house style *itself* — a `#compliance` or gate check that
+  misfires, two chapters that contradict, a **Contract** that is wrong or
+  unclear, a recurring need it is silent on — is reported back to the standard,
+  not left in this session's transcript: a dated note in the standard repo's
+  `feedback/` inbox (or the same note handed to a person to drop there).
 - Never silently diverge from a **Contract**. A deliberate deviation is
   recorded in this section with its reason.
 - Where the house style is silent, do what is idiomatic for the stack.
@@ -1350,7 +1359,7 @@ governs it and follow that chapter — the slugs are the index (a `<script>` →
 - production-url: https://example.com
 - content-type: tool           # tool | article  (article => feeds)
 - publishing-rate: ~5 pages/week
-- standard-version: 2026-09-01  # optional pin
+- standard-version: 2026-09-02  # recommended — enables standard-version drift tracking (#compliance)
 ```
 
 If the section is absent, the assistant's first action is to run the flow above
@@ -1363,6 +1372,18 @@ worked incrementally (the impl doc's migration path is the ordered version of
 that backlog). The project is not expected to be all-`PASS` on day one; it is
 expected to know exactly where it isn't.
 
+**Feedback to the standard.** Adopting the house style is what surfaces its
+bugs — a check that misfires, a `core.md` ↔ impl-doc contradiction, a Contract
+that doesn't survive a real codebase, a need it never anticipated. That signal
+belongs to the standard, not only to the project session that hit it: fixes
+flow standard → template → project, and this is the one path back. The
+mechanism is deliberately minimal — a dated note in the standard repo's
+`feedback/` inbox (what is wrong · which project · `standard-version`);
+`feedback/README.md` has the shape. A session that can't reach the standard's
+tree, or a content-only session, hands a person the same note to file. Triage
+empties the inbox into `CHANGELOG` changes or a one-line `wontfix`. This is
+separate from the project's own state and backlog.
+
 **Change checklist (stack-agnostic)** — run before merging to `main`, and again
 before `bin/deploy`. (On a multi-committer project this is also the PR-review
 checklist.)
@@ -1463,6 +1484,9 @@ Each impl doc keeps its own stack-specific out-of-scope list.
   unknown what's actually left or what regressed.
 - A `standard-version` pin left behind the standard's current version with no
   `CHANGELOG`-delta re-check.
+- A defect in the standard found while adopting it — a check that misfires, a
+  chapter contradiction, an unclear Contract — worked around silently or left in
+  a session transcript instead of dropped in the standard's `feedback/` inbox.
 - A permalink changed with no `301` from the old path.
 - A default branch other than `main`.
 - Deploying by pushing to a branch instead of the sanctioned gated command.
@@ -1489,5 +1513,6 @@ mirrored chapter; impl-only chapters take slugs that appear nowhere here.
 `adopting` · `out-of-scope` · `anti-patterns`
 
 **Shared-concept drift guard** — defined only here; an impl doc may state the
-*how*, never restate the *what*: `the-gate`, `ci-cd`, `third-parties`,
-`brand-source`, `noindex`, `content-model`, `beyond-this-standard`.
+*how*, never restate the *what*: `the-gate`, `compliance`, `ci-cd`,
+`third-parties`, `brand-source`, `noindex`, `content-model`,
+`beyond-this-standard`, `ads`, `llm-integration`.